An interesting piece of spam

[Alan Karp]

I don't know why, but I've been getting more spam in my inbox the last several months.  Most of it's obvious, like the one below.  The interesting thing is that the link behind "Your PackageIs Out forDelivery" is 

https://www.linkedin.com/slink?code=eB9WEw#V4WUtDRXZhN25

What's with the linkedin.com domain?  Does LinkedIn host third-party services?

(I don't want any of you guys clicking on a link that's connected to my email address, so I edited the query string, fragment, and link in the forwarded message :)

--------------
Alan Karp

---------- Forwarded message ---------
From: Fedeeex <dqtax...@x30dqwaa.onmicrosoft.com>
Date: Tue, Mar 28, 2023 at 10:06 AM
Subject: Notiif: FedeXPackage#408
To: <alan...@gmail.com>, <alan...@aol.com>
Cc: <alan...@gmail.com>

YourPackageIs Out forDelivery

[๏̯͡๏ Jasvir Nagra]

This is a well known vector - in this case for linkedin.  LinkedIn slinks is a redirection service that linkedin hosts for businesses that advertise on it.  Phishers use it, as you'd expect, to get around domain based reputation antimalware services.  To the extent people associate reputation with domains, it's unfortunate that linkedin chose to launch the redirection service directly on that domain. 

-- 

Jasvir Nagra

--
You received this message because you are subscribed to the Google Groups "friam" group.
To unsubscribe from this group and stop receiving emails from it, send an email to friam+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/friam/CANpA1Z0JgBLYAu266S5zrGjVFm7Whf5%2BsRUXDc1SXCKOWeCWYg%40mail.gmail.com.